# Ensure journald Is Not Configured to Receive Logs from Remote Clients

- Source: https://support.icompaas.com/support/solutions/articles/62000235547-ensure-journald-is-not-configured-to-receive-logs-from-remote-clients
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Linux 2 Benchmark v3.0.0](https://support.icompaas.com/support/solutions/62000112696) › [CIS Amazon Linux 2 Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169265)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: **• Level 1**

Description:  
 The systemd journal (journald) can be configured to accept log messages from remote clients. Disabling this feature prevents unauthorized or malicious external sources from injecting logs into the local journal, protecting the integrity of system logs.

Rationale:  
 Preventing journald from receiving remote logs reduces the risk of log poisoning and ensures that only locally generated logs are trusted, enhancing overall system security.

Impact:  
 Pros:

-   Protects against unauthorized log injection from remote sources.  
    
-   Maintains the integrity and trustworthiness of local logs.  
    

Cons:

-   Disabling remote logging may limit centralized log aggregation capabilities.  
    

Default Value:  
 By default, journald does not accept logs from remote clients unless explicitly configured.

Pre-requisites:

-   Root or sudo privileges to modify journald configuration.  
    

Remediation:

### Test Plan:

Using Linux command line:

Check if journald is configured to receive remote logs:

grep "^ReceiveRemote" /etc/systemd/journald.conf

1.  Confirm that ReceiveRemote is set to no.  
    

### Implementation Plan:

Using Linux command line:

Edit the journald configuration file:  

vi /etc/systemd/journald.conf

Set the following parameter to disable remote logging:

ReceiveRemote=no

Save the file and restart journald:

systemctl restart systemd-journald

Verify the setting:

grep "^ReceiveRemote" /etc/systemd/journald.conf

### Backout Plan:

Using Linux command line:

Re-enable remote log reception if needed:  

ReceiveRemote=yes

Restart journald:

systemctl restart systemd-journald

2.  Confirm remote logging is enabled.  
    

References:

-   CIS Amazon Linux 2 Benchmark v3.0.0  
    
-   systemd-journald Documentation  
    
-   [NIST SP 800-53 Revision 5 - AU-6  
      
    ](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final#au-6)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.